Secure software development

will be given a program with a format-string vulnerability; their task is to exploit the vulnerability to achieve the following damage: (1) crash the program, (2) read the internal memory of the program, (3) modify the internal mem- ory of the program, and most severely, (4) inject and execute malicious code using the victim program’s privilege. The last consequence is very dangerous if the vulnerable program is a privileged program, such as a root daemon, because that can give attackers the root access of the system. This lab covers the following topics: • Format string vulnerability • Code injection • Shellcode • Reverse shell